AWS Organizations & Consolidated Billing

AWS Organizations = manage multiple AWS accounts centrally

Management (payer) account
├── OU: Production (SCP: strict)
│   ├── prod-app account
│   └── prod-db account
├── OU: Development (SCP: relaxed)
│   └── dev account
└── OU: Sandbox

Core features

1. Consolidated billing — ONE bill, volume discounts across ALL accounts
   • RI / Savings Plans SHARED across accounts (pool discounts)
   • Payer account pays everything; member accounts run workloads
2. SCPs (Service Control Policies) — guardrails on ACCOUNTS (what an account CAN do)
   • NOT IAM (IAM = what a USER can do; SCP = account-level boundary)
   • Even root/admin can’t exceed SCP. “prod OU can’t delete S3”
3. OUs — organize accounts by purpose (prod/dev/sandbox)
4. Cost allocation tags — track spend per team/project
5. Central management — create/invite accounts, apply policies

GCP mapping (same concept)

AWS:  Organization → OU → Account → IAM user
GCP:  Organization → Folder → Project → IAM member

SCP                ≈ Organization policy constraints
Consolidated billing ≈ Billing account + linked projects

Exam facts

• “manage multiple accounts centrally” → AWS Organizations
• “share RI discounts across accounts” → Consolidated billing
• “account-level guardrails” → SCPs
• “track spend per project” → Cost allocation tags
• Management account controls org; member accounts = workloads

Related

• [[aws/index]]
• [[aws/ec2-pricing/index]]
• [[aws/support-plans/index]]